topic Re: Why is the map command in my search no longer returning results? in Splunk Search

Why is the map command in my search no longer returning results?

kallisrayar1986 — Thu, 01 Sep 2016 00:01:01 GMT

Hi,

I would like to get the values of an event that matches a median value of that event. My search is something like this:

index = "index" test_id = "test_id" Scenario = "scenario" | stats median(field) as "SomeName" | map [search index = "index" test_id = "test_id" Scenario = "scenario" AND field = $SomeName$ | stats values by test_id ]

it used to work before, but for some reason it is not now. Please help.

Re: Why is the map command in my search no longer returning results?

sundareshr — Thu, 01 Sep 2016 03:34:27 GMT

You may be able to get your results using just a subsearch, like this

index = "index" test_id = "test_id" Scenario = "scenario"  [search index = "index" test_id = "test_id" Scenario = "scenario" | stats median(field) as field]   | stats values by test_id

OR avoid the sub-search with this

index = "index" test_id = "test_id" Scenario = "scenario"  | eventstats median(field) as med | where field=med | stats values by test_id

Re: Why is the map command in my search no longer returning results?

kallisrayar1986 — Thu, 01 Sep 2016 18:59:55 GMT

thank you Sundareshr, it worked.